EUVD-2026-67466
GHSA-7jc6-6627-m946
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
HTTP 'referer' parameter is network-accessible with no authentication or user interaction; impact is database read-only exfiltration, no integrity or availability compromise.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Lifecycle Timeline
2DescriptionCVE.org
The wpForo Forum plugin for WordPress is vulnerable to SQL Injection via the 'referer' parameter in all versions up to, and including, 2.4.17. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Articles & Coverage 1
AnalysisAI
SQL injection via the 'referer' HTTP parameter in wpForo Forum (WordPress plugin, all versions up to and including 2.4.17) allows unauthenticated remote attackers to append arbitrary SQL to existing queries and exfiltrate the entire WordPress database, including user credentials and private forum content. The flaw is confined to data extraction - the CVSS vector confirms no integrity or availability impact - but the complete absence of authentication requirements and low attack complexity make any publicly reachable WordPress install running this plugin an exposed target. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The wpForo Forum plugin must be installed and active on a WordPress site at version 2.4.17 or earlier. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, score 7.5) signals a high-priority concern: network-reachable, unauthenticated, low-complexity exploitation with high confidentiality impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade wpForo Forum to version 3.0.0 or later; the WordPress plugin trac changeset (https://plugins.trac.wordpress.org/changeset?old=3483044&old_path=%2Fwpforo%2Ftags%2F2.4.17&new=3500199&new_path=%2Fwpforo%2Ftags%2F3.0.0) confirms remediation changes in the affected files across the revisions module and core functions. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: identify and inventory all WordPress installations running wpForo versions 2.4.17 and below, deactivate the plugin if operations permit, and implement Web Application Firewall rules to block SQL injection syntax in HTTP referer parameters. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Wpforo Forum
View allThe wpForo Forum plugin for WordPress is vulnerable to Local File Include, Server-Side Request Forgery, and PHAR Deseria
The wpForo Forum plugin for WordPress is vulnerable to SQL Injection via the 'slug' attribute of the 'wpforo' shortcode
The wpForo Forum WordPress plugin before 2.1.9 does not escape some request parameters while in debug mode, leading to a
The wpForo Forum WordPress plugin before 1.9.7 did not validate the redirect_to parameter in the login form of the forum
wpforo_get_request_uri in wpf-includes/functions.php in the wpForo Forum plugin before 1.4.12 for WordPress allows Unaut
Unauthenticated PHP Object Injection in the wpForo Forum WordPress plugin versions 3.1.0 and earlier allows remote attac
Authentication bypass in the wpForo Forum WordPress plugin versions 3.1.0 and earlier allows remote unauthenticated atta
Stored cross-site scripting in wpForo Forum WordPress plugin before 3.1.2 allows a subscriber-level authenticated user t
Insecure Direct Object Reference (IDOR) in the wpForo Forum WordPress plugin before 3.1.2 allows any subscriber-level au
Unauthenticated SQL injection in the wpForo Forum WordPress plugin (versions 3.0.4 and earlier) allows remote attackers
Arbitrary file deletion in wpForo Forum WordPress plugin versions ≤2.4.16 allows authenticated attackers with subscriber
Auth. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today